auth0 4.0.0-beta.5 → 4.0.0-beta.7

package/dist/esm/auth/oauth.d.ts

@@ -0,0 +1,297 @@
+import { InitOverride, JSONApiResponse, VoidApiResponse } from '../lib/runtime.js';
+import { BaseAuthAPI, AuthenticationClientOptions } from './base-auth-api.js';
+import { IDTokenValidateOptions } from './id-token-validator.js';
+export interface TokenSet {
+    /**
+     * The access token.
+     */
+    access_token: string;
+    /**
+     * The refresh token, vavailable with the `offline_access` scope.
+     */
+    refresh_token?: string;
+    /**
+     * The user's ID Token.
+     */
+    id_token?: string;
+    /**
+     * The token type of the access token.
+     */
+    token_type: 'Bearer';
+    /**
+     * The duration in secs that that the access token is valid.
+     */
+    expires_in: number;
+}
+export interface GrantOptions {
+    idTokenValidateOptions?: Pick<IDTokenValidateOptions, 'organization'>;
+    initOverrides?: InitOverride;
+}
+export interface AuthorizationCodeGrantOptions {
+    idTokenValidateOptions?: IDTokenValidateOptions;
+    initOverrides?: InitOverride;
+}
+export interface ClientCredentials {
+    /**
+     * Specify this to override the parent class's `clientId`
+     */
+    client_id?: string;
+    /**
+     * Specify this to override the parent class's `clientSecret`
+     */
+    client_secret?: string;
+    /**
+     * Specify this to provide your own client assertion JWT rather than
+     * the class creating one for you from the `clientAssertionSigningKey`.
+     */
+    client_assertion?: string;
+    /**
+     * If you provide your own `client_assertion` you should also provide
+     * the `client_assertion_type`.
+     */
+    client_assertion_type?: 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer';
+}
+export interface AuthorizationCodeGrantRequest extends ClientCredentials {
+    /**
+     * The Authorization Code received from the initial `/authorize` call.
+     */
+    code: string;
+    /**
+     *	This is required only if it was set at the `/authorize` endpoint. The values must match.
+     */
+    redirect_uri?: string;
+    /**
+     * Allow for any custom property to be sent to Auth0
+     */
+    [key: string]: any;
+}
+export interface AuthorizationCodeGrantWithPKCERequest extends AuthorizationCodeGrantRequest {
+    /**
+     * Cryptographically random key that was used to generate the code_challenge passed to `/authorize`.
+     */
+    code_verifier: string;
+}
+export interface ClientCredentialsGrantRequest extends ClientCredentials {
+    /**
+     * The unique identifier of the target API you want to access.
+     */
+    audience: string;
+}
+export interface PasswordGrantRequest extends ClientCredentials {
+    /**
+     * The unique identifier of the target API you want to access.
+     */
+    audience?: string;
+    /**
+     * Resource Owner's identifier, such as a username or email address.
+     */
+    username: string;
+    /**
+     * Resource Owner's secret.
+     */
+    password: string;
+    /**
+     * String value of the different scopes the application is asking for. Multiple scopes are separated with whitespace.
+     */
+    scope?: string;
+    /**
+     * String value of the realm the user belongs. Set this if you want to add realm support at this grant.
+     * For more information on what realms are refer to https://auth0.com/docs/get-started/authentication-and-authorization-flow/resource-owner-password-flow#realm-support.
+     */
+    realm?: string;
+}
+export interface DeviceCodeGrantRequest {
+    /**
+     * Specify this to override the parent class's `clientId`
+     */
+    client_id?: string;
+    /**
+     * The device code previously returned from the `/oauth/device/code` endpoint.
+     */
+    device_code: string;
+}
+export interface RefreshTokenGrantRequest extends ClientCredentials {
+    /**
+     * The Refresh Token to use.
+     */
+    refresh_token: string;
+    /**
+     * A space-delimited list of requested scope permissions.
+     * If not sent, the original scopes will be used; otherwise you can request a reduced set of scopes.
+     */
+    scope?: string;
+    /**
+     * Allow for any custom property to be sent to Auth0
+     */
+    [key: string]: any;
+}
+export interface RevokeRefreshTokenRequest extends ClientCredentials {
+    /**
+     * The Refresh Token you want to revoke.
+     */
+    token: string;
+}
+export interface TokenExchangeGrantRequest {
+    /**
+     * Specify this to override the parent class's `clientId`
+     */
+    client_id?: string;
+    /**
+     * Externally-issued identity artifact, representing the user.
+     */
+    subject_token: string;
+    /**
+     * The unique identifier of the target API you want to access.
+     */
+    audience?: string;
+    /**
+     * String value of the different scopes the application is requesting.
+     * Multiple scopes are separated with whitespace.
+     */
+    scope?: string;
+    /**
+     * Optional element used for native iOS interactions for which profile updates can occur.
+     * Expected parameter value will be JSON in the form of: `{ name: { firstName: 'John', lastName: 'Smith }}`
+     */
+    user_profile: string;
+}
+/**
+ *  OAuth 2.0 flows.
+ */
+export declare class OAuth extends BaseAuthAPI {
+    private idTokenValidator;
+    constructor(options: AuthenticationClientOptions);
+    /**
+     * This is the flow that regular web apps use to access an API.
+     *
+     * Use this endpoint to exchange an Authorization Code for a Token.
+     *
+     * See: https://auth0.com/docs/api/authentication#authorization-code-flow44
+     *
+     * @example
+     * ```js
+     * const auth0 = new AuthenticationApi({
+     *    domain: 'my-domain.auth0.com',
+     *    clientId: 'myClientId',
+     *    clientSecret: 'myClientSecret'
+     * });
+     *
+     * await auth0.oauth.authorizationCodeGrant({ code: 'mycode' });
+     * ```
+     */
+    authorizationCodeGrant(bodyParameters: AuthorizationCodeGrantRequest, options?: AuthorizationCodeGrantOptions): Promise<JSONApiResponse<TokenSet>>;
+    /**
+     * PKCE was originally designed to protect the authorization code flow in mobile apps,
+     * but its ability to prevent authorization code injection makes it useful for every type of OAuth client,
+     * even web apps that use client authentication.
+     *
+     * See: https://auth0.com/docs/api/authentication#authorization-code-flow-with-pkce45
+     *
+     * @example
+     * ```js
+     * const auth0 = new AuthenticationApi({
+     *    domain: 'my-domain.auth0.com',
+     *    clientId: 'myClientId',
+     *    clientSecret: 'myClientSecret'
+     * });
+     *
+     * await auth0.oauth.authorizationCodeGrantWithPKCE({
+     *   code: 'mycode',
+     *   code_verifier: 'mycodeverifier'
+     * });
+     * ```
+     */
+    authorizationCodeGrantWithPKCE(bodyParameters: AuthorizationCodeGrantWithPKCERequest, options?: AuthorizationCodeGrantOptions): Promise<JSONApiResponse<TokenSet>>;
+    /**
+     * This is the OAuth 2.0 grant that server processes use to access an API.
+     *
+     * Use this endpoint to directly request an Access Token by using the Client's credentials
+     * (a Client ID and a Client Secret or a Client Assertion).
+     *
+     * See: https://auth0.com/docs/api/authentication#client-credentials-flow
+     *
+     * @example
+     * ```js
+     * const auth0 = new AuthenticationApi({
+     *    domain: 'my-domain.auth0.com',
+     *    clientId: 'myClientId',
+     *    clientSecret: 'myClientSecret'
+     * });
+     *
+     * await auth0.oauth.clientCredentialsGrant({ audience: 'myaudience' });
+     * ```
+     */
+    clientCredentialsGrant(bodyParameters: ClientCredentialsGrantRequest, options?: {
+        initOverrides?: InitOverride;
+    }): Promise<JSONApiResponse<TokenSet>>;
+    /**
+     * This information is typically received from a highly trusted public client like a SPA*.
+     * (<strong>*Note:</string> For single-page applications and native/mobile apps, we recommend using web flows instead.)
+     *
+     * See: https://auth0.com/docs/api/authentication#resource-owner-password
+     *
+     * @example
+     * ```js
+     * const auth0 = new AuthenticationApi({
+     *    domain: 'my-domain.auth0.com',
+     *    clientId: 'myClientId'
+     *    clientSecret: 'myClientSecret'
+     * });
+     *
+     * await auth0.oauth.passwordGrant({
+     *     username: 'myusername@example.com',
+     *     password: 'mypassword'
+     *   },
+     *   { initOverrides: { headers: { 'auth0-forwarded-for': 'END.USER.IP.123' } } }
+     * );
+     * ```
+     *
+     * Set the'auth0-forwarded-for' header to the end-user IP as a string value if you want
+     * brute-force protection to work in server-side scenarios.
+     *
+     * See https://auth0.com/docs/get-started/authentication-and-authorization-flow/avoid-common-issues-with-resource-owner-password-flow-and-attack-protection
+     *
+     */
+    passwordGrant(bodyParameters: PasswordGrantRequest, options?: GrantOptions): Promise<JSONApiResponse<TokenSet>>;
+    /**
+     * Use this endpoint to refresh an Access Token using the Refresh Token you got during authorization.
+     *
+     * See: https://auth0.com/docs/api/authentication#refresh-token
+     *
+     * @example
+     * ```js
+     * const auth0 = new AuthenticationApi({
+     *    domain: 'my-domain.auth0.com',
+     *    clientId: 'myClientId'
+     *    clientSecret: 'myClientSecret'
+     * });
+     *
+     * await auth0.oauth.refreshTokenGrant({ refresh_token: 'myrefreshtoken' })
+     * ```
+     */
+    refreshTokenGrant(bodyParameters: RefreshTokenGrantRequest, options?: GrantOptions): Promise<JSONApiResponse<TokenSet>>;
+    /**
+     * Use this endpoint to invalidate a Refresh Token if it has been compromised.
+     *
+     * The behaviour of this endpoint depends on the state of the <a href="https://auth0.com/docs/secure/tokens/refresh-tokens/revoke-refresh-tokens#refresh-tokens-and-grants">Refresh Token Revocation Deletes Grant</a> toggle.
+     * If this toggle is enabled, then each revocation request invalidates not only the specific token, but all other tokens based on the same authorization grant.
+     * This means that all Refresh Tokens that have been issued for the same user, application, and audience will be revoked.
+     * If this toggle is disabled, then only the refresh token is revoked, while the grant is left intact.
+     *
+     * See: https://auth0.com/docs/api/authentication#revoke-refresh-token
+     *
+     * @example
+     * ```js
+     * const auth0 = new AuthenticationApi({
+     *    domain: 'my-domain.auth0.com',
+     *    clientId: 'myClientId'
+     *    clientSecret: 'myClientSecret'
+     * });
+     *
+     * await auth0.oauth.revokeRefreshToken({ token: 'myrefreshtoken' })
+     * ```
+     */
+    revokeRefreshToken(bodyParameters: RevokeRefreshTokenRequest, options?: {
+        initOverrides?: InitOverride;
+    }): Promise<VoidApiResponse>;
+}

package/dist/esm/auth/oauth.js

@@ -1,5 +1,5 @@
-import { JSONApiResponse, VoidApiResponse, validateRequiredRequestParams, } from '../lib/runtime.js';
-import { BaseAuthAPI } from './base-auth-api.js';
+import { VoidApiResponse, validateRequiredRequestParams, } from '../lib/runtime.js';
+import { BaseAuthAPI, grant } from './base-auth-api.js';
 import { IDTokenValidator } from './id-token-validator.js';
 /**
  *  OAuth 2.0 flows.
@@ -9,33 +9,6 @@ export class OAuth extends BaseAuthAPI {
         super(options);
         this.idTokenValidator = new IDTokenValidator(options);
     }
-    async validateIdToken(tokenSet, idTokenValidateOptions) {
-        const { id_token: idToken } = tokenSet;
-        if (idToken) {
-            await this.idTokenValidator.validate(idToken, idTokenValidateOptions);
-        }
-    }
-    /**
-     * Perform an OAuth 2.0 grant.
-     * (You should only need this if you can't find the grant you need in this library.)
-     */
-    async grant(grantType, bodyParameters, { idTokenValidateOptions, initOverrides } = {}) {
-        const response = await this.request({
-            path: '/oauth/token',
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/x-www-form-urlencoded',
-            },
-            body: new URLSearchParams({
-                client_id: this.clientId,
-                ...bodyParameters,
-                grant_type: grantType,
-            }),
-        }, initOverrides);
-        const res = await JSONApiResponse.fromResponse(response);
-        await this.validateIdToken(res.data, idTokenValidateOptions);
-        return res;
-    }
     /**
      * This is the flow that regular web apps use to access an API.
      *
@@ -56,7 +29,7 @@ export class OAuth extends BaseAuthAPI {
      */
     async authorizationCodeGrant(bodyParameters, options = {}) {
         validateRequiredRequestParams(bodyParameters, ['code']);
-        return this.grant('authorization_code', await this.addClientAuthentication(bodyParameters, true), options);
+        return grant('authorization_code', await this.addClientAuthentication(bodyParameters), options, this.clientId, this.idTokenValidator, this.request.bind(this));
     }
     /**
      * PKCE was originally designed to protect the authorization code flow in mobile apps,
@@ -81,7 +54,7 @@ export class OAuth extends BaseAuthAPI {
      */
     async authorizationCodeGrantWithPKCE(bodyParameters, options = {}) {
         validateRequiredRequestParams(bodyParameters, ['code', 'code_verifier']);
-        return this.grant('authorization_code', await this.addClientAuthentication(bodyParameters, false), options);
+        return grant('authorization_code', await this.addClientAuthentication(bodyParameters), options, this.clientId, this.idTokenValidator, this.request.bind(this));
     }
     /**
      * This is the OAuth 2.0 grant that server processes use to access an API.
@@ -104,7 +77,7 @@ export class OAuth extends BaseAuthAPI {
      */
     async clientCredentialsGrant(bodyParameters, options = {}) {
         validateRequiredRequestParams(bodyParameters, ['audience']);
-        return this.grant('client_credentials', await this.addClientAuthentication(bodyParameters, true), options);
+        return grant('client_credentials', await this.addClientAuthentication(bodyParameters), options, this.clientId, this.idTokenValidator, this.request.bind(this));
     }
     /**
      * This information is typically received from a highly trusted public client like a SPA*.
@@ -120,11 +93,11 @@ export class OAuth extends BaseAuthAPI {
      *    clientSecret: 'myClientSecret'
      * });
      *
-     * await auth0.oauth.clientCredentialsGrant({
+     * await auth0.oauth.passwordGrant({
      *     username: 'myusername@example.com',
      *     password: 'mypassword'
      *   },
-     *   { headers: { 'auth0-forwarded-for': 'END.USER.IP.123' } }
+     *   { initOverrides: { headers: { 'auth0-forwarded-for': 'END.USER.IP.123' } } }
      * );
      * ```
      *
@@ -136,7 +109,7 @@ export class OAuth extends BaseAuthAPI {
      */
     async passwordGrant(bodyParameters, options = {}) {
         validateRequiredRequestParams(bodyParameters, ['username', 'password']);
-        return this.grant(bodyParameters.realm ? 'http://auth0.com/oauth/grant-type/password-realm' : 'password', await this.addClientAuthentication(bodyParameters, false), options);
+        return grant(bodyParameters.realm ? 'http://auth0.com/oauth/grant-type/password-realm' : 'password', await this.addClientAuthentication(bodyParameters), options, this.clientId, this.idTokenValidator, this.request.bind(this));
     }
     /**
      * Use this endpoint to refresh an Access Token using the Refresh Token you got during authorization.
@@ -156,7 +129,7 @@ export class OAuth extends BaseAuthAPI {
      */
     async refreshTokenGrant(bodyParameters, options = {}) {
         validateRequiredRequestParams(bodyParameters, ['refresh_token']);
-        return this.grant('refresh_token', await this.addClientAuthentication(bodyParameters, false), options);
+        return grant('refresh_token', await this.addClientAuthentication(bodyParameters), options, this.clientId, this.idTokenValidator, this.request.bind(this));
     }
     /**
      * Use this endpoint to invalidate a Refresh Token if it has been compromised.
@@ -187,7 +160,7 @@ export class OAuth extends BaseAuthAPI {
             headers: {
                 'Content-Type': 'application/json',
             },
-            body: await this.addClientAuthentication({ client_id: this.clientId, ...bodyParameters }, false),
+            body: await this.addClientAuthentication({ client_id: this.clientId, ...bodyParameters }),
         }, options.initOverrides);
         return VoidApiResponse.fromResponse(response);
     }

package/dist/esm/auth/oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../src/auth/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,eAAe,EACf,eAAe,EACf,6BAA6B,GAC9B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,WAAW,EAA+B,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAA0B,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAsKnF;;GAEG;AACH,MAAM,OAAO,KAAM,SAAQ,WAAW;IAEpC,YAAY,OAAoC;QAC9C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,gBAAgB,GAAG,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACxD,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,QAAkB,EAClB,sBAA+C;QAE/C,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC;QACvC,IAAI,OAAO,EAAE;YACX,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;SACvE;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,KAAK,CACT,SAAiB,EACjB,cAAmC,EACnC,EAAE,sBAAsB,EAAE,aAAa,KAAmB,EAAE;QAE5D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CACjC;YACE,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;aACpD;YACD,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,SAAS,EAAE,IAAI,CAAC,QAAQ;gBACxB,GAAG,cAAc;gBACjB,UAAU,EAAE,SAAS;aACtB,CAAC;SACH,EACD,aAAa,CACd,CAAC;QAEF,MAAM,GAAG,GAA8B,MAAM,eAAe,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QACpF,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;QAC7D,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,sBAAsB,CAC1B,cAA6C,EAC7C,UAAyC,EAAE;QAE3C,6BAA6B,CAAC,cAAc,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QAExD,OAAO,IAAI,CAAC,KAAK,CACf,oBAAoB,EACpB,MAAM,IAAI,CAAC,uBAAuB,CAAC,cAAc,EAAE,IAAI,CAAC,EACxD,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,KAAK,CAAC,8BAA8B,CAClC,cAAqD,EACrD,UAAyC,EAAE;QAE3C,6BAA6B,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;QAEzE,OAAO,IAAI,CAAC,KAAK,CACf,oBAAoB,EACpB,MAAM,IAAI,CAAC,uBAAuB,CAAC,cAAc,EAAE,KAAK,CAAC,EACzD,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,KAAK,CAAC,sBAAsB,CAC1B,cAA6C,EAC7C,UAA4C,EAAE;QAE9C,6BAA6B,CAAC,cAAc,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAE5D,OAAO,IAAI,CAAC,KAAK,CACf,oBAAoB,EACpB,MAAM,IAAI,CAAC,uBAAuB,CAAC,cAAc,EAAE,IAAI,CAAC,EACxD,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,KAAK,CAAC,aAAa,CACjB,cAAoC,EACpC,UAAwB,EAAE;QAE1B,6BAA6B,CAAC,cAAc,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;QAExE,OAAO,IAAI,CAAC,KAAK,CACf,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,kDAAkD,CAAC,CAAC,CAAC,UAAU,EACtF,MAAM,IAAI,CAAC,uBAAuB,CAAC,cAAc,EAAE,KAAK,CAAC,EACzD,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,iBAAiB,CACrB,cAAwC,EACxC,UAAwB,EAAE;QAE1B,6BAA6B,CAAC,cAAc,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC;QAEjE,OAAO,IAAI,CAAC,KAAK,CACf,eAAe,EACf,MAAM,IAAI,CAAC,uBAAuB,CAAC,cAAc,EAAE,KAAK,CAAC,EACzD,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,KAAK,CAAC,kBAAkB,CACtB,cAAyC,EACzC,UAA4C,EAAE;QAE9C,6BAA6B,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QAEzD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CACjC;YACE,IAAI,EAAE,eAAe;YACrB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,MAAM,IAAI,CAAC,uBAAuB,CACtC,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,cAAc,EAAE,EAC/C,KAAK,CACN;SACF,EACD,OAAO,CAAC,aAAa,CACtB,CAAC;QAEF,OAAO,eAAe,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC;CACF"}
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../src/auth/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,eAAe,EACf,6BAA6B,GAC9B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,WAAW,EAA+B,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACrF,OAAO,EAA0B,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAgLnF;;GAEG;AACH,MAAM,OAAO,KAAM,SAAQ,WAAW;IAEpC,YAAY,OAAoC;QAC9C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,gBAAgB,GAAG,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACxD,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,sBAAsB,CAC1B,cAA6C,EAC7C,UAAyC,EAAE;QAE3C,6BAA6B,CAAC,cAAc,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QAExD,OAAO,KAAK,CACV,oBAAoB,EACpB,MAAM,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAAC,EAClD,OAAO,EACP,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,gBAAgB,EACrB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CACxB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,KAAK,CAAC,8BAA8B,CAClC,cAAqD,EACrD,UAAyC,EAAE;QAE3C,6BAA6B,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;QAEzE,OAAO,KAAK,CACV,oBAAoB,EACpB,MAAM,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAAC,EAClD,OAAO,EACP,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,gBAAgB,EACrB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CACxB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,KAAK,CAAC,sBAAsB,CAC1B,cAA6C,EAC7C,UAA4C,EAAE;QAE9C,6BAA6B,CAAC,cAAc,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAE5D,OAAO,KAAK,CACV,oBAAoB,EACpB,MAAM,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAAC,EAClD,OAAO,EACP,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,gBAAgB,EACrB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CACxB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,KAAK,CAAC,aAAa,CACjB,cAAoC,EACpC,UAAwB,EAAE;QAE1B,6BAA6B,CAAC,cAAc,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;QAExE,OAAO,KAAK,CACV,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,kDAAkD,CAAC,CAAC,CAAC,UAAU,EACtF,MAAM,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAAC,EAClD,OAAO,EACP,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,gBAAgB,EACrB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CACxB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,iBAAiB,CACrB,cAAwC,EACxC,UAAwB,EAAE;QAE1B,6BAA6B,CAAC,cAAc,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC;QAEjE,OAAO,KAAK,CACV,eAAe,EACf,MAAM,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAAC,EAClD,OAAO,EACP,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,gBAAgB,EACrB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CACxB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,KAAK,CAAC,kBAAkB,CACtB,cAAyC,EACzC,UAA4C,EAAE;QAE9C,6BAA6B,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QAEzD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CACjC;YACE,IAAI,EAAE,eAAe;YACrB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,MAAM,IAAI,CAAC,uBAAuB,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,cAAc,EAAE,CAAC;SAC1F,EACD,OAAO,CAAC,aAAa,CACtB,CAAC;QAEF,OAAO,eAAe,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC;CACF"}

package/dist/esm/auth/passwordless.d.ts

@@ -0,0 +1,165 @@
+import { InitOverride, JSONApiResponse, VoidApiResponse } from '../lib/runtime.js';
+import { BaseAuthAPI, AuthenticationClientOptions } from './base-auth-api.js';
+import { ClientCredentials, GrantOptions, TokenSet } from './oauth.js';
+export interface SendEmailLinkRequest {
+    /**
+     * The user's email address
+     */
+    email: string;
+    /**
+     * Use `link` to send a link or `code` to send a verification code.
+     * If omitted, a `link` will be sent.
+     */
+    send?: 'link';
+    /**
+     * Append or override the link parameters (like `scope`, `redirect_uri`, `protocol`, `response_type`),
+     * when you send a link using email.
+     */
+    authParams?: Record<string, unknown>;
+}
+export interface SendEmailCodeRequest {
+    /**
+     * The user's email address
+     */
+    email: string;
+    /**
+     * Use `link` to send a link or `code` to send a verification code.
+     * If omitted, a `link` will be sent.
+     */
+    send?: 'code';
+}
+export type SendEmailRequest = SendEmailLinkRequest | SendEmailCodeRequest;
+export interface SendSmsRequest {
+    /**
+     * The users phone number.
+     */
+    phone_number: string;
+}
+export interface LoginWithEmailRequest extends ClientCredentials {
+    /**
+     * The user's email address.
+     */
+    email: string;
+    /**
+     * The user's verification code.
+     */
+    code: string;
+    /**
+     * API Identifier of the API for which you want to get an Access Token.
+     */
+    audience?: string;
+    /**
+     * Use openid to get an ID Token, or openid profile email to also include user profile information in the ID Token.
+     */
+    scope?: string;
+}
+export interface LoginWithSMSRequest extends Omit<LoginWithEmailRequest, 'email'> {
+    /**
+     * The user's phone number.
+     */
+    phone_number: string;
+}
+/**
+ * Handles passwordless flows using Email and SMS.
+ */
+export declare class Passwordless extends BaseAuthAPI {
+    private idTokenValidator;
+    constructor(configuration: AuthenticationClientOptions);
+    /**
+     * Start passwordless flow sending an email.
+     *
+     * Given the user `email` address, it will send an email with:
+     *
+     * <ul>
+     *   <li>A link (default, `send:"link"`). You can then authenticate with this
+     *     user opening the link and he will be automatically logged in to the
+     *     application. Optionally, you can append/override parameters to the link
+     *     (like `scope`, `redirect_uri`, `protocol`, `response_type`, etc.) using
+     *     `authParams` object.
+     *   </li>
+     *   <li>
+     *     A verification code (`send:"code"`). You can then authenticate with
+     *     this user using the `/oauth/token` endpoint specifying `email` as
+     *     `username` and `code` as `password`.
+     *   </li>
+     * </ul>
+     *
+     * See: https://auth0.com/docs/api/authentication#get-code-or-link
+     *
+     * @example
+     * ```js
+     * const auth0 = new AuthenticationApi({
+     *    domain: 'my-domain.auth0.com',
+     *    clientId: 'myClientId',
+     *    clientSecret: 'myClientSecret'
+     * });
+     *
+     * await auth0.passwordless.sendEmail({
+     *   email: '{EMAIL}',
+     *   send: 'link',
+     *   authParams: {} // Optional auth params.
+     * });
+     * ```
+     */
+    sendEmail(bodyParameters: SendEmailRequest, initOverrides?: InitOverride): Promise<VoidApiResponse>;
+    /**
+     * Start passwordless flow sending an SMS.
+     *
+     * Given the user `phone_number`, it will send a SMS message with a
+     * verification code. You can then authenticate with this user using the
+     * `/oauth/token` endpoint specifying `phone_number` as `username` and `code` as
+     * `password`:
+     *
+     * See: https://auth0.com/docs/api/authentication#get-code-or-link
+     *
+     * @example
+     * ```js
+     * const auth0 = new AuthenticationApi({
+     *    domain: 'my-domain.auth0.com',
+     *    clientId: 'myClientId',
+     *    clientSecret: 'myClientSecret'
+     * });
+     *
+     * await auth0.passwordless.sendSMS({
+     *   phone_number: '{PHONE}'
+     * });
+     * ```
+     */
+    sendSMS(bodyParameters: SendSmsRequest, initOverrides?: InitOverride): Promise<VoidApiResponse>;
+    /**
+     * Once you have a verification code, use this endpoint to login the user with their email and verification code.
+     *
+     * @example
+     * ```js
+     * const auth0 = new AuthenticationApi({
+     *    domain: 'my-domain.auth0.com',
+     *    clientId: 'myClientId',
+     *    clientSecret: 'myClientSecret'
+     * });
+     *
+     * await auth0.passwordless.loginWithEmail({
+     *   email: 'foo@example.com',
+     *   code: 'ABC123'
+     * });
+     * ```
+     */
+    loginWithEmail(bodyParameters: LoginWithEmailRequest, options?: GrantOptions): Promise<JSONApiResponse<TokenSet>>;
+    /**
+     * Once you have a verification code, use this endpoint to login the user with their phone number and verification code.
+     *
+     * @example
+     * ```js
+     * const auth0 = new AuthenticationApi({
+     *    domain: 'my-domain.auth0.com',
+     *    clientId: 'myClientId',
+     *    clientSecret: 'myClientSecret'
+     * });
+     *
+     * await auth0.passwordless.loginWithSMS({
+     *   phone_number: '0777777777',
+     *   code: 'ABC123'
+     * });
+     * ```
+     */
+    loginWithSMS(bodyParameters: LoginWithSMSRequest, options?: GrantOptions): Promise<JSONApiResponse<TokenSet>>;
+}

package/dist/esm/auth/passwordless.js

@@ -1,13 +1,13 @@
 import { VoidApiResponse, validateRequiredRequestParams, } from '../lib/runtime.js';
-import { BaseAuthAPI } from './base-auth-api.js';
-import { OAuth } from './oauth.js';
+import { BaseAuthAPI, grant } from './base-auth-api.js';
+import { IDTokenValidator } from './id-token-validator.js';
 /**
  * Handles passwordless flows using Email and SMS.
  */
 export class Passwordless extends BaseAuthAPI {
     constructor(configuration) {
         super(configuration);
-        this.oauth = new OAuth(configuration);
+        this.idTokenValidator = new IDTokenValidator(configuration);
     }
     /**
      * Start passwordless flow sending an email.
@@ -53,7 +53,11 @@ export class Passwordless extends BaseAuthAPI {
             headers: {
                 'Content-Type': 'application/json',
             },
-            body: await this.addClientAuthentication({ client_id: this.clientId, connection: 'email', ...bodyParameters }, false),
+            body: await this.addClientAuthentication({
+                client_id: this.clientId,
+                connection: 'email',
+                ...bodyParameters,
+            }),
         }, initOverrides);
         return VoidApiResponse.fromResponse(response);
     }
@@ -88,7 +92,11 @@ export class Passwordless extends BaseAuthAPI {
             headers: {
                 'Content-Type': 'application/json',
             },
-            body: await this.addClientAuthentication({ client_id: this.clientId, connection: 'sms', ...bodyParameters }, false),
+            body: await this.addClientAuthentication({
+                client_id: this.clientId,
+                connection: 'sms',
+                ...bodyParameters,
+            }),
         }, initOverrides);
         return VoidApiResponse.fromResponse(response);
     }
@@ -112,12 +120,12 @@ export class Passwordless extends BaseAuthAPI {
     async loginWithEmail(bodyParameters, options = {}) {
         validateRequiredRequestParams(bodyParameters, ['email', 'code']);
         const { email: username, code: otp, ...otherParams } = bodyParameters;
-        return this.oauth.grant('http://auth0.com/oauth/grant-type/passwordless/otp', await this.addClientAuthentication({
+        return grant('http://auth0.com/oauth/grant-type/passwordless/otp', await this.addClientAuthentication({
             username,
             otp,
             realm: 'email',
             ...otherParams,
-        }, false), options);
+        }), options, this.clientId, this.idTokenValidator, this.request.bind(this));
     }
     /**
      * Once you have a verification code, use this endpoint to login the user with their phone number and verification code.
@@ -139,12 +147,12 @@ export class Passwordless extends BaseAuthAPI {
     async loginWithSMS(bodyParameters, options = {}) {
         validateRequiredRequestParams(bodyParameters, ['phone_number', 'code']);
         const { phone_number: username, code: otp, ...otherParams } = bodyParameters;
-        return this.oauth.grant('http://auth0.com/oauth/grant-type/passwordless/otp', await this.addClientAuthentication({
+        return grant('http://auth0.com/oauth/grant-type/passwordless/otp', await this.addClientAuthentication({
             username,
             otp,
             realm: 'sms',
             ...otherParams,
-        }, false), options);
+        }), options, this.clientId, this.idTokenValidator, this.request.bind(this));
     }
 }
 //# sourceMappingURL=passwordless.js.map

package/dist/esm/auth/passwordless.js.map

@@ -1 +1 @@
-{"version":3,"file":"passwordless.js","sourceRoot":"","sources":["../../../src/auth/passwordless.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,eAAe,EACf,6BAA6B,GAC9B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,WAAW,EAA+B,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAAE,KAAK,EAA6C,MAAM,YAAY,CAAC;AAkE9E;;GAEG;AACH,MAAM,OAAO,YAAa,SAAQ,WAAW;IAE3C,YAAY,aAA0C;QACpD,KAAK,CAAC,aAAa,CAAC,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;IACxC,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;IACH,KAAK,CAAC,SAAS,CACb,cAAgC,EAChC,aAA4B;QAE5B,6BAA6B,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QAEzD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CACjC;YACE,IAAI,EAAE,qBAAqB;YAC3B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,MAAM,IAAI,CAAC,uBAAuB,CACtC,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,cAAc,EAAE,EACpE,KAAK,CACN;SACF,EACD,aAAa,CACd,CAAC;QAEF,OAAO,eAAe,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,KAAK,CAAC,OAAO,CACX,cAA8B,EAC9B,aAA4B;QAE5B,6BAA6B,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC;QAEhE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CACjC;YACE,IAAI,EAAE,qBAAqB;YAC3B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,MAAM,IAAI,CAAC,uBAAuB,CACtC,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,cAAc,EAAE,EAClE,KAAK,CACN;SACF,EACD,aAAa,CACd,CAAC;QAEF,OAAO,eAAe,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,cAAc,CAClB,cAAqC,EACrC,UAAwB,EAAE;QAE1B,6BAA6B,CAAC,cAAc,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QAEjE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,WAAW,EAAE,GAAG,cAAc,CAAC;QAEtE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CACrB,oDAAoD,EACpD,MAAM,IAAI,CAAC,uBAAuB,CAChC;YACE,QAAQ;YACR,GAAG;YACH,KAAK,EAAE,OAAO;YACd,GAAG,WAAW;SACf,EACD,KAAK,CACN,EACD,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,YAAY,CAChB,cAAmC,EACnC,UAAwB,EAAE;QAE1B,6BAA6B,CAAC,cAAc,EAAE,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;QAExE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,WAAW,EAAE,GAAG,cAAc,CAAC;QAE7E,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CACrB,oDAAoD,EACpD,MAAM,IAAI,CAAC,uBAAuB,CAChC;YACE,QAAQ;YACR,GAAG;YACH,KAAK,EAAE,KAAK;YACZ,GAAG,WAAW;SACf,EACD,KAAK,CACN,EACD,OAAO,CACR,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"passwordless.js","sourceRoot":"","sources":["../../../src/auth/passwordless.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,eAAe,EACf,6BAA6B,GAC9B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,WAAW,EAA+B,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACrF,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAmE3D;;GAEG;AACH,MAAM,OAAO,YAAa,SAAQ,WAAW;IAE3C,YAAY,aAA0C;QACpD,KAAK,CAAC,aAAa,CAAC,CAAC;QAErB,IAAI,CAAC,gBAAgB,GAAG,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;IACH,KAAK,CAAC,SAAS,CACb,cAAgC,EAChC,aAA4B;QAE5B,6BAA6B,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QAEzD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CACjC;YACE,IAAI,EAAE,qBAAqB;YAC3B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,MAAM,IAAI,CAAC,uBAAuB,CAAC;gBACvC,SAAS,EAAE,IAAI,CAAC,QAAQ;gBACxB,UAAU,EAAE,OAAO;gBACnB,GAAG,cAAc;aAClB,CAAC;SACH,EACD,aAAa,CACd,CAAC;QAEF,OAAO,eAAe,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,KAAK,CAAC,OAAO,CACX,cAA8B,EAC9B,aAA4B;QAE5B,6BAA6B,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC;QAEhE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CACjC;YACE,IAAI,EAAE,qBAAqB;YAC3B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,MAAM,IAAI,CAAC,uBAAuB,CAAC;gBACvC,SAAS,EAAE,IAAI,CAAC,QAAQ;gBACxB,UAAU,EAAE,KAAK;gBACjB,GAAG,cAAc;aAClB,CAAC;SACH,EACD,aAAa,CACd,CAAC;QAEF,OAAO,eAAe,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,cAAc,CAClB,cAAqC,EACrC,UAAwB,EAAE;QAE1B,6BAA6B,CAAC,cAAc,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QAEjE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,WAAW,EAAE,GAAG,cAAc,CAAC;QAEtE,OAAO,KAAK,CACV,oDAAoD,EACpD,MAAM,IAAI,CAAC,uBAAuB,CAAC;YACjC,QAAQ;YACR,GAAG;YACH,KAAK,EAAE,OAAO;YACd,GAAG,WAAW;SACf,CAAC,EACF,OAAO,EACP,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,gBAAgB,EACrB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CACxB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,YAAY,CAChB,cAAmC,EACnC,UAAwB,EAAE;QAE1B,6BAA6B,CAAC,cAAc,EAAE,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;QAExE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,WAAW,EAAE,GAAG,cAAc,CAAC;QAE7E,OAAO,KAAK,CACV,oDAAoD,EACpD,MAAM,IAAI,CAAC,uBAAuB,CAAC;YACjC,QAAQ;YACR,GAAG;YACH,KAAK,EAAE,KAAK;YACZ,GAAG,WAAW;SACf,CAAC,EACF,OAAO,EACP,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,gBAAgB,EACrB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CACxB,CAAC;IACJ,CAAC;CACF"}